An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute arbitrary code via the unserialize function. Note: This has been disputed by third parties as incomplete and incorrect. The framework does not have a version that surpasses 2.x.x and was deprecated in early 2020.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HZend Framework
APPZend≤ 3.1.3
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCEDeserialization
CWE
Related vulnerabilities
CVE-2021-3007CRITICAL9.8PL ✓same product
Podatność deserialization RCE w Laminas-Http i Zend Framework
CVE-2014-8089CRITICAL9.8PL ✓same product
SQL Injection w Zend Framework przez null byte (sqlsrv)
CVE-2011-1939CRITICAL9.8PL ✓same product
SQL injection w Zend Framework przy użyciu kodowań non-ASCII z PDO_MySql
CVE-2014-4914CRITICAL9.8PL ✓same product
SQL injection w Zend Framework przez funkcję Zend_Db_Select::order
CVE-2015-1555CRITICAL9.1PL ✓same product
Zend Framework: Obejście walidatorów sesji w SessionManager